Who Signs Off on a New AI Use Case?

Buying an approved AI tool does not approve every use of it. A new workflow can introduce different data, affected people, actions and consequences without changing the subscription.

AI use-case approval should follow those operating facts. Name one accountable business owner, bring the relevant specialists into review and identify who has authority to accept the remaining exposure.

The existing AI ownership guide explains the wider accountability model. This article turns that model into an intake-to-decision workflow for one proposed use.

Key takeaways

• Approve a defined use, not a product name alone.

• Name the business owner before technical review begins.

• Route specialist review according to facts and consequence.

• Distinguish advice, approval and risk acceptance authority.

• Record conditions, expiry or review triggers and the deployed version.

Step 1: Capture the minimum useful intake

Ask for purpose, user group, data classes, model or provider, integrations, output audience and permitted actions. Identify affected people and what happens when the result is wrong. Request references to sensitive evidence rather than pasting private data into an open intake form.

The business owner should explain the intended outcome and alternative. A proposal that cannot identify who needs the result may be a technology experiment rather than a deployment request. That can still be worthwhile under a properly bounded experiment approval.

Step 2: Route by risk-relevant facts

Use agreed criteria for data sensitivity, external effects, autonomy, potential harm and obligations. The organization should define the actual tiers and delegated powers. This article does not prescribe a legal risk classification.

NIST's AI RMF connects context mapping, governance, measurement and management. The practical implication is that reviewers need to understand the use before they can decide which evidence and controls matter.

Step 3: Make the approval path visible

This illustrative workflow assigns functions, not specific company titles or universal approval powers. Replace each authority with the actual role in the organization's delegation model.

Stage	Responsible function	Required output
Intake	Accountable business owner.	Defined use, intended outcome, scope and consequence.
Triage	Designated AI governance or risk coordinator.	Review path based on agreed criteria and missing facts.
Specialist review	Relevant security, privacy, legal, technical and operational reviewers.	Evidence assessment, conditions and unresolved issues.
Decision	Authorized business approver or escalation body.	Approve, narrow, defer or reject within delegated authority.
Deployment and review	Operating owner with control owners.	Versioned record, monitoring, fallback and change triggers.

A reviewer's favorable opinion is not automatically the final approval. Equally, a business approval cannot substitute for a required legal or technical condition. Make the distinction explicit in the decision record.

Step 4: Record a bounded yes

Specify the data, population, environment, actions and version covered. State controls, monitoring, training and any conditions that must be met before deployment. Identify the owner who verifies those conditions.

Define what brings the use back for review: a new provider, expanded audience, changed data, automated action or material performance concern. The copilot reclassification test helps identify an operating change that a product label can conceal.

Keep a no or defer useful too. Explain which evidence, control or authority is missing and whether a narrower experiment is available. Do not turn a deferral into permission to proceed quietly.

Step 5: Verify deployment matches approval

Check the actual account, integrations and workflow after launch. The approved design can differ from what employees use. Record the deployed scope in the inventory and retain a route for incident reports and questions.

Review whether the process is fast enough for legitimate low-risk work without weakening significant decisions. Long queues and unclear answers can encourage unreviewed uses. Improve the route rather than treating every delay as an employee problem.

Sources

NIST, AI Risk Management Framework 1.0, Govern, Map, Measure and Manage; NIST, AI RMF Playbook: Govern. Workflow roles and tiering considerations are editorial recommendations.

Frequently asked questions

Does procurement approval authorize deployment?

Only if the organization's actual authority model explicitly covers that decision and scope. Buying a tool and approving a consequential use are different questions.

Must the board approve every AI use?

Not generally as an operating design. Reserve decisions according to the company's governance, significance and applicable obligations; delegate other decisions clearly.

Can one person own every control?

A business owner can coordinate accountability while specialist control owners perform distinct work. Do not confuse one accountable use owner with one person doing everything.

What should an employee do while approval is pending?

Follow the stated interim rule and approved alternatives. The process should make clear what is permitted, rather than leaving silence to be interpreted as consent.

Closing

A usable approval process ends with a defined use and a named decision maker. If the team can show only a purchase order or a meeting invitation, the operating approval still needs to be made explicit.